# Renderer SSRF via user content User content reaching a server-side renderer that fetches iframes, url() or UNC paths _Area: Web infrastructure and server-side requests. Seen in 9 disclosed reports; 7 confirmed bounties, median $1,500, range $400-$25,000; latest 2025-09-22. Updated 2026-10-23._ ## How it works A server-side renderer (PDF converter, headless browser, image library) treats user-supplied content as active markup and resolves external references itself. The assumption that breaks is that the renderer only draws pixels or text; in fact it fetches iframes, `url()`/`xlink:href` resources, `foreignObject` HTML and UNC paths, and does so from the server's network position, reaching internal hosts and cloud metadata [E1](https://bugbountylibrary.com/r/h1%3A2262382.md)[E2](https://bugbountylibrary.com/r/h1%3A1628209.md)[E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-imds-anomaly-hunting-zero-day.md)[E6](https://bugbountylibrary.com/r/blog%3Apwn-vg-articles-2021-05-ssrf-in-pdf-renderer-using-svg.md)[E8](https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-how-i-got-400-usd-for-my-first-ssrf-bug.md). A related shape is a sanitizer that fails to recognize a reference form, so the fetch happens anyway [E7](https://bugbountylibrary.com/r/h1%3A1115139.md). ## Where it shows up - Error messages that interpolate user input and are then fed to a PDF/HTML renderer [E1](https://bugbountylibrary.com/r/h1%3A2262382.md) - Stored user fields embedded unsanitized into HTML rendered server-side [E2](https://bugbountylibrary.com/r/h1%3A1628209.md) - SVG `xlink:href`/`url()` with absolute URLs; SVG `foreignObject` carrying XHTML iframes [E4](https://bugbountylibrary.com/r/h1%3A223203.md)[E6](https://bugbountylibrary.com/r/blog%3Apwn-vg-articles-2021-05-ssrf-in-pdf-renderer-using-svg.md) - SVG with UNC paths (`\\host\share`) resolved by librsvg/ImageMagick [E3](https://bugbountylibrary.com/r/h1%3A288353.md) - Raw HTML parameters on HTML-to-PDF endpoints; iframe `src` with `file://` or `169.254.169.254` [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-imds-anomaly-hunting-zero-day.md)[E8](https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-how-i-got-400-usd-for-my-first-ssrf-bug.md) - Uploads processed before the file-type check rejects them [E4](https://bugbountylibrary.com/r/h1%3A223203.md) - Sanitizers confused by malformed foreign-content prefixes like `

` [E7](https://bugbountylibrary.com/r/h1%3A1115139.md) ## How to review Trace every path where user data reaches a renderer and confirm the invariant: the renderer must not resolve attacker-chosen external references, or outbound requests must be restricted to an allowlist that excludes internal, link-local and metadata addresses. Check egress policy and DNS resolution at the renderer, not just input validation. Check that error strings are escaped before rendering [E1](https://bugbountylibrary.com/r/h1%3A2262382.md). For "SVG only" validation, confirm `foreignObject` and embedded HTML are rejected [E6](https://bugbountylibrary.com/r/blog%3Apwn-vg-articles-2021-05-ssrf-in-pdf-renderer-using-svg.md). Confirm processing happens only after validation passes [E4](https://bugbountylibrary.com/r/h1%3A223203.md). Confirm the renderer runs with no metadata access (IMDSv2 enforced) as defense in depth, not prevention [E5](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-imds-anomaly-hunting-zero-day.md). ## Variants seen - Reflected template name in PDF error message [E1](https://bugbountylibrary.com/r/h1%3A2262382.md) - Stored JS in a name field executed by the PDF generator [E2](https://bugbountylibrary.com/r/h1%3A1628209.md) - SMB/UNC fetch leaking NTLMv2 credentials [E3](https://bugbountylibrary.com/r/h1%3A288353.md) - SVG `xlink:href` fetched before corrupt-image rejection; chained refs as file-presence oracle [E4](https://bugbountylibrary.com/r/h1%3A223203.md) - Pandoc rendering `